Description
In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Skip vport under deletion in report ID acquisition

qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under
vport_slock, takes a vref_count on the matching vport and calls
qla_update_host_map() to register its port id.

A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then
qla24xx_disable_vp() removes the vport from the host_map btree and zeroes
vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later,
in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)
but does not touch host_map. In the window in between, report ID
acquisition can still find the vport on vp_list and call
qla_update_host_map(); with d_id already zeroed it takes the
btree_insert32() path and re-inserts the dying vport into host_map.
Nothing cleans that entry afterwards, so once scsi_host_put() frees the
vha a later host_map lookup dereferences freed memory.

Skip a vport that has VPORT_DELETE set before taking the reference, so it
is neither re-registered nor scheduled for DPC re-registration. This
mirrors the existing guard in qla2x00_alert_all_vps().
Published: 2026-09-25
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Use‑after‑free leading to possible denial of service
Action: Immediate Patch
AI Analysis

Impact

The qla2xxx SCSI driver in the Linux kernel contains a use‑after‑free flaw. During report ID acquisition a virtual port marked for deletion is still referenced, causing the driver to re‑insert the dying vport into the host mapping after its underlying host has already been freed. This leads to a dereference of freed memory and can crash the kernel, resulting in a denial‑of‑service condition. The weakness is a classic use‑after‑free bug, identified as CWE‑416.

Affected Systems

Any Linux kernel that includes the qla2xxx driver and has virtual SCSI ports enabled is affected. No specific kernel versions are listed in the CVE data; the flaw exists in any kernel build containing the vulnerable driver code before the patch commit. The impact is limited to installations running the qla2xxx driver without the corrective changes.

Risk and Exploitability

The CVSS score is 7.5. EPSS information is not available, and the flaw is not listed in CISA’s KEV catalog, implying no known public exploits at this time. The vulnerability requires the attacker to interact with the kernel driver, which typically implies privileged or local access. Given the high severity CVSS and the potential for a kernel crash, the risk is substantial for affected systems that allow privileged users to load or interact with the driver.

Generated by OpenCVE AI on September 26, 2026 at 00:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a kernel version that includes the qla2xxx patch; the commit that fixes the use‑after‑free resides in mainline and is incorporated into stable releases.
  • If a kernel upgrade cannot be applied immediately, unload or disable the qla2xxx SCSI driver, or cease use of virtual port support until a patched kernel is available.
  • Ensure that only trusted, privileged users can load or modify kernel modules, and monitor for unauthorized module load attempts to limit the attack surface.

Generated by OpenCVE AI on September 26, 2026 at 00:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 25 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id. A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory. Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps().
Title scsi: qla2xxx: Skip vport under deletion in report ID acquisition
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T14:41:09.714Z

Reserved: 2026-09-24T16:01:01.153Z

Link: CVE-2026-97531

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:03.307

Modified: 2026-09-25T15:17:58.300

Link: CVE-2026-97531

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T00:15:16Z

Weaknesses